Two-factor authentication (2FA)
Definition
Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
Also called: 2FA, two-factor authentication, two factor authentication, MFA, multi-factor authentication
Last updated
Why it matters for WordPress
Passwords leak from other sites, phishing, and shared agency logins. 2FA means the password alone should not open wp-admin. For site owners and agencies, it is one of the highest-value controls you can turn on in an afternoon.
How it shows up in practice
- An authenticator prompt after the password on Administrator (and ideally Editor)
- Recovery codes stored offline for a lost phone
- Stuffing attempts that succeed on the password step, then fail without the code
- Support tickets from staff who need a recovery path after a device change
What to do
- Require 2FA for all privileged roles, not only your personal admin.
- Prefer app-based TOTP over SMS when you have the choice.
- Keep login rate limits on so stuffing still costs the attacker time.
- Have a recovery path: an admin who can reset 2FA, or a second method such as email codes.
In WP Security Ninja
Two-factor authentication adds app or email codes for key roles. Rollout steps: how to enable 2FA on WordPress. Use it with login protection so bots cannot spray forever while someone without 2FA still sits on Administrator. Broader login hardening: WordPress login security guide.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- Brute force A brute-force attack tries many passwords or tokens until one works, usually against the login form.
- Credential stuffing Credential stuffing replays usernames and passwords stolen from other breaches against your login.
- Phishing Phishing tricks people into handing over credentials or installing malware by impersonating a trusted party.
- Login protection Login protection is the set of controls that harden the WordPress login against bots and credential attacks.
- Account takeover Account takeover is when an attacker gains control of a legitimate user account and can act as that user.
- Application passwords Application passwords are per-app credentials WordPress can issue so integrations authenticate without using your main password.
